Troubleshooting with Logging and Diagnostics
The various FSLogix components create comprehensive logs. These logs are found in the following three (3) log types:
- Client event logs
- Text-based Log files
- Event Trace Logging (ETL)
Reviewing or collecting logs can be a great first step in the support process before opening a support case. The FSLogix Support Tool was created to help customers collect all the necessary logs into a single zipped archive.
Client event logs
FSLogix utilizes the Windows Event Log system to provide other data during many of the operations and tasks. These event logs can be found in the Windows Event Viewer under Applications and Services Logs -> FSLogix. Most event logs data is written in either the Admin or Operational logs under Apps. Event log data specific to Cloud Cache is written to either the Admin or Operational logs under CloudCache.
Figure 7: FSLogix Event Logs
Text-based log files
Text-based log files are the first place to look when troubleshooting FSLogix and requires the logging settings have been configured.
Log file location:
The most common log file used when troubleshooting an issue is the
Profile_%date%.log found in
How to review profile logs
Notepad++ is a great text editor as it provides the ability to highlight sets of keywords or phrases.
Open the latest log file from
Take note of the following sections: Computer Name, FSLogix version(s), and service status.
Figure 1: Profile log file
Ctrl+Fto open the Find dialog and search for the sign in event for a specific user (for example, jdoe).
- Find what:
Figure 2: Profile log search dialog
- Find what:
Ensure the sign in event is in line with the time of the reported issue or problem.
Next, note the process id for this user as this ID is used during the entire sequence of the event (sign in or sign out).
Use the style feature to highlight the following sections within the log file:
Begin Session: Logon
Begin Session: Logoff
Figure 3: Profile log stylize terms
With these keywords stylized, it's easier to locate the sign in and sign out events.
Figure 4: Example 1
Figure 5: Example 2
Optionally, after you've stylized all the keywords, you can focus on a specific process for a user's event by selecting the process id. Notepad++ will highlight all occurrences of this process ID so you can follow its sequence as there may be other processes running for other users at the same time.
Figure 6: Profile log process ID
Each action in the log file will have a prefix for the type of event.
[INFO] for informational events,
[WARN:xxxxxx] indicates Warnings, and
[ERROR:xxxxxx] for Errors. Both Warnings and Error will have a corresponding error code.
Event Trace Logging (ETL)
FSLogix implements trace logging, which creates Event Trace Logs (
ETL) files. There are two (2)
ETL files, which are created and saved. The
ETL files are saved to
C:\ProgramData\FSLogix\Logs\, and are named
trace.etl.002. The files are rotated using round-robin, with the oldest file being replaced with a new file after two files have been created. The
ETL files are capped at 100-MB maximum file size.
ETL files are managed by Windows autologger. Trace data is held in a buffer and written to the
ETL files as needed and overwritten at the designated threshold. Each time the computer is restarted, the
ETL files are rotated according to the configuration.
Event Trace Logging is intended for Microsoft Internal Use only.
Submit and view feedback for